POPIA

Why this page exists

POPIA applies to almost every South African business, and telecommunications touches personal information constantly — numbers called, when, for how long, and often the recording of what was said. If you're buying communications services, your compliance and ours are connected. This sets out both sides.

Our position

• We're the responsible party for information we hold about you as our customer — your account, your billing, your correspondence.
• We're the operator for information you process using our platform — your customers' numbers, your call recordings, your contact lists. You decide what and why; we process on your instruction and protect it.
• Both roles are set out in the agreement between us.

The eight conditions

POPIA sets eight conditions for lawful processing. Here's how the platform supports each.

• Accountability — documented processing purposes, retention rules and access controls per tenant.
• Processing limitation — consent state stored per contact with timestamp and source; opt-out enforced at submission rather than cleaned up afterwards.
• Purpose specification — recording rules carry a stated purpose rather than a blanket on/off setting.
• Further processing limitation — data collected for routing and billing isn't repurposed.
• Information quality — you can correct records; corrections are logged.
• Openness — this page, the privacy policy, and a straight answer if you ask.
• Security safeguards — encryption in transit, access auditing, tamper detection on recordings, fraud monitoring.
• Data subject participation — tooling to locate, export and delete a specific person's records on request.

Call recording specifically

Recording is lawful where you have a basis for it and meet the notification requirements. RICA governs interception; POPIA governs the personal information inside the recording. In practice:

• Tell people they're being recorded — an announcement or IVR message at the start of the call.
• Have a documented purpose. "For quality and training" is acceptable if it's true.
• Apply a retention limit and stick to it. Indefinite retention is hard to defend.
• Be able to find and delete a specific person's recordings on request.
• Control and log who can listen.

The platform provides consent capture, retention policy per tenant, legal hold, tamper detection and a full access audit log. The policy decisions remain yours — we can't make them for you, and we'd be wrong to pretend otherwise.

Data location

Our core network and storage are in South Africa. Recordings and call records stay in-country under South African law. For many buyers — particularly in financial services and the public sector — that removes a cross-border transfer question entirely.

Subject access requests

If someone asks you for their information and it's held on our platform, we'll help you locate, export or delete it. Email noc@zephyrtelecomms.com with the request reference and we'll prioritise it — the statutory clock is running on you, not us.

Breach notification

If a security compromise affects personal information we hold or process for you, we'll notify you without undue delay with what we know, what we're doing, and what you may need to report. We won't wait until we have a complete picture to tell you something happened.

The Information Regulator

You can complain to the Information Regulator of South Africa about how we handle personal information. We'd rather you raised it with us first so we can fix it, but the right is yours either way.